1. Field of the Invention
The invention relates to a system and method for usage of a role certificate in encryption, and as a seal, digital stamp, and a signature. More particularly, the invention employs a method and computer program in which a role certificate enables more than one individual or entity of an identifiable group to encrypt and decrypt information as well as sign, stamp, or seal any information using the same role certificate.
2. Background
For centuries individuals, governments, and business entities have searched for mechanisms and techniques whereby sensitive information may be transmitted to authorized parties over long distances and still remain secure. The problem faced by the foregoing entities is how information can be sent to the individual or entities that require it and still be assured that unauthorized parties may not be able to comprehend the transmitted information should they intercept it. Early methods of securing information have employed scrambling techniques, lookup tables, substitution ciphers, and code books in which letters or terms would be substituted for the original letters and terms in the information. These techniques frequently required that both the sender and receiver of information have access to the same “code book”. One danger in such a technique is that the code book could fall into unauthorized hands.
In the early twentieth century, and particular during World War II, code books were replaced by electromechanical cipher machines. Both the sender and receiver would have an identical cipher machine used to encrypt and decrypt messages sent. In order to make it more difficult to decrypt these messages, the cipher machines have the ability to change the cipher used in a message or change the cipher used for every few words within a message. In order to accomplish this, the cipher machine would need to know the initial state or key utilized to encrypt the message.
In recent years, the cipher machines have been replaced by digital encryption algorithms in which both the sender and receiver have an identical copy of the digital encryption algorithm and a common key used to encrypt and decrypt messages. Both the encryption algorithm and key are held secret by both the sender and receiver.
More recently, another encryption technique has been developed in which two separate keys are used for encryption and decryption. A public key is transmitted freely to whoever requires it and is used to encrypt messages for a particular receiver. The receiver would have an associated private key which may be used to decrypt the message encrypted with the associated public key. For each public key there is only one private key and for each private key there is only one public key. When sending a message to several recipients, it is necessary to have each recipient's public key. The message would then be separately encrypted using each recipient's public key and transmitted to that particular recipient. Therefore, if ten separate entities are to receive the same message, then separate messages would be transmitted with each message encrypted with the individual's public key. With the advent of the Internet, such a public key infrastructure has gained significant acceptance as discussed in request for comments number 2459, by Ford et al., entitled “Internet X.509 Public Key Infrastructure”, herein incorporated in its entirety by reference.
In addition to the need for the encryption and decryption of messages with the advent of electronic mail and the Internet, a need has developed for a secure mechanism to indicate approval and acceptance by an individual. In the past, an individual would typically show his approval or acceptance of such items as a contract or an order via a handwritten signature, a stamp, or a seal which would only be held by that individual. Anyone else that attempted to imitate such a signature, stamp, or seal would be subject to criminal penalties. With the advent of electronic mail and the Internet, a need has arisen to take advantage of the ease and speed of electronic mail to indicate, by a person or entity with proper authority, approval or acceptance of a contract or purchase. This has come to be known as a digital signature in which an individual may digitally sign a document.
This digital signature capability has been implemented using the same public key infrastructure previously discussed. However, instead of an entire document being encrypted, the document itself is passed through a one-way hashing algorithm that produces a small document, referred to as a digest. This digest is then encrypted using the individual's private key, also known as a private signing key, and is appended to the document. The receiver of the document can verify the authenticity of the digital signature (digest) by stripping the signature from the document and recomputing the hash function on the document to generate an as received digest. Using a public signing key, included in the document or previously received, it is possible to decrypt the digest of the document and compare it to the digest as received. If the two digests match, then the signature is authenticated. Therefore, in using the aforementioned public key infrastructure, it is possible to both encrypt and decrypt messages as well as digitally sign documents.
However, in the aforementioned public key infrastructure, in order for a group of individuals or entities to transmit and receive the encrypted messages each individual must have created a key pair having a public key and a private key. Further, each individual or entity in a group is also required to have separate public and private signing keys in order to digitally sign documents. In order for other members of the group to be able to decrypt messages received, it is necessary for members of the group to exchange key pairs including the private key. This may be necessary when a member of the group is not in the office due to illness or travel. Where such an exchange of key pairs does not take place, when an urgent encrypted message comes into, for example, the office of finance, human resources, or an engineering group in the corporation, only the person holding the private key may decrypt the message. When the person is unavailable, that message will not be decrypted and a prompt response will not be received by the sender. However, when key pairs are exchanged by members of a group, then all members who possess an individual's private key may decrypt all messages sent to that person, regardless of the nature of the message or its sensitivity. This creates significant problems for businesses that need to respond quickly to customer requests and in which customer confidences must be maintained. This may most acutely be seen in law offices, medical offices, and the military where delay in delivering a response may be very costly. Further, it is cumbersome for a large group of individuals or entities to exchange key pairs with one another. For example, where a group contains 30 individuals, a total of 30 times 30, or 900 exchanges of key pairs must take place in order for anyone in the group to be able to decrypt any message received by any other member of the group.
Regarding the exchange of private signing keys, it is to be noted that a similar need exists for members of a group to be able to sign documents on behalf of the group in certain instances. For example, the office of financial affairs for a corporation receives requests for approval of purchasing orders. Such purchasing orders may be for items which are frequently required by the corporation and for which funds have been allocated. However, it should not be necessary for the chief financial officer to approve each and every transaction. Further, the disbursement of private signature keys to all members of the office of finance for the corporation may be very unwise. What this means is that a low-level purchasing officer may approve large expenditures using the vice president of finance's private signature key. In addition, this invites and perhaps even encourages fraud and embezzlement.
Further, when an organization maintains separate key pairs for both encryption and signature purposes, this further adds to the complexity of maintaining and disbursing private keys for both encryption and signatures. Ideally, a single digital certificate should be used for both encryption and signature purposes by all authorized members of a group. In addition, policies should be established to indicate the limitations associated with a group digital signature. For example, a policy for purchase approval on a digital signature from the office of finance in a corporation may be limited to purchases of no greater than $100,000. Beyond this limit a personal signature of the chief financial officer is required to approve such a purchase. In addition, this policy should be publicly available, at least within the organization, so that others may verify that the digital signature issued by a group is valid under the policy.
Therefore, what is needed is a method and computer program in which digital “role” certificates may be used for both encryption and signature purposes for a group. The possession of such a role certificate, by an authorized member of a group issuing the role certificate, should enable that person to decrypt messages sent to others within the group that were encrypted using the digital certificate. Further, this method and computer program should enable authorized members of a group to sign on behalf of the group within limits set by publicly available policies. Still further, this system and computer program should create processes that allow the creation and receipt of role certificates to be used as an organizational stamp and for organizational encryption. This system and computer program should contain procedures for replacement of such a role certificate, revocation of a role certificate, recovery of a role certificate, terminating of roles, and recovery of terminated roles.